Comprehensive SSRF Guide
Comprehensive SSRF Guide A practitioner’s reference for Server-Side Request Forgery — attack surface, exploitation techniques, bypass methods, real-world chains, and detection/prevention. Compiled from 299 research sources. Table of Contents Fundamentals Attack Surface & Entry Points IP Address Bypass Techniques URL Parsing & Protocol Tricks Cloud Metadata Exploitation Blind SSRF Techniques Protocol Smuggling Framework-Specific SSRF PDF Generator SSRF Real-World Exploitation Chains Tools & Automation MCP / AI Agent SSRF IPv6 & DNS Rebinding Bypass Patterns Detection & Prevention Payload Quick Reference 1. Fundamentals SSRF occurs when an attacker can make a server-side application send HTTP requests to an attacker-chosen destination. The server acts as a proxy, often with elevated network access (internal services, cloud metadata, localhost) and implicit trust (firewall bypass, authentication context). ...